Self-service Application registration (open POST /v1/applications) #32

POST /v1/applications is platform-admin-only (applications.manage). Outside developers can't register their own Applications. The review mechanics it feeds are already built: review_status, review_notes, the transitions, and the application.review_status_changed audit event. Only the self-service submission path is missing.

Spec: Applications → The review lifecycle, API Reference → Applications → Reviewing a submission, Roadmap → Phase 3.

Trigger: the marketplace phase, when concierge onboarding stops scaling. The hosted sign-in page (AUTHORIZE_URL) has to exist before any third-party Application can go live.

Scope:

• Open POST /v1/applications to authenticated developers: create it as pending_review, owned by the caller (or by their Organization), and auto-provision the Tenant
• Edit-to-resubmit for rejected Applications
• A FIFO review queue view for applications.manage holders (the list filter on review_status may be enough)
• Rate limits and abuse controls on submission
• OpenAPI, tests, and the Changelog